8534c93775db5069ace4e024f653e5149cca9dcb0fdfd1e2c2ce4cd5b10355c9.zip
- SHA256 1473d12f22627943193f4b0cb9eb633ab000e502c0cc35c5c4ec332162e8393e
Password
infected
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
8534c93775db5069ace4e024f653e5149cca9dcb0fdfd1e2c2ce4cd5b10355c9.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
8534c93775db5069ace4e024f653e5149cca9dcb0fdfd1e2c2ce4cd5b10355c9.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target 8534c93775db5069ace4e024f653e5149cca9dcb0fdfd1e2c2ce4cd5b10355c9.zip
- Size 1.6MB
- Sample260722-a17cpsha68
- SHA256 1473d12f22627943193f4b0cb9eb633ab000e502c0cc35c5c4ec332162e8393e
- MD5 6dce3d983dc63404654774c36c28d5f8
- SHA1 3ba58dcb56f1c2812171f5728bdd07793fbcb43c
- SHA512 956809783e06497e53c62fd7a0242233805211e3bf36b6df42ee2c503868a151a41634e59baf206da444a3d657fe97f77787c8aa0e4ab41f8336f9d1d5020cc1
- SSDEEP 49152:vurWPKQYCUpH0E3z7ueCkm7gTi287uUHU:v4WPKxhv6Hb+8RHU
- TLSH T1347533F8D454FC465B7B761CB23AC0C4F9AA81E21EAEA5B4E69CE4415D4043C0F47EBA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Detect suspicious telegram bot 1 IoCs
Detect suspicious telegram bot.
resource yara_rule static1/unpack001/8534c93775db5069ace4e024f653e5149cca9dcb0fdfd1e2c2ce4cd5b10355c9 suspicious_telegram_bot - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/8534c93775db5069ace4e024f653e5149cca9dcb0fdfd1e2c2ce4cd5b10355c9
File Explorer
-
8534c93775db5069ace4e024f653e5149cca9dcb0fdfd1e2c2ce4cd5b10355c9.zip.zip 1.6MB
-
8534c93775db5069ace4e024f653e5149cca9dcb0fdfd1e2c2ce4cd5b10355c9.exe 3.0MB
8534c93775db5069ace4e024f653e5149cca9dcb0fdfd1e2c2ce4cd5b10355c9
- IMPHASH b514a1b6ac4520cb93e762169d0bd7f1
- SHA256 8534c93775db5069ace4e024f653e5149cca9dcb0fdfd1e2c2ce4cd5b10355c9
- MD5 62476e8b101b3fb8267eae59a0cc986d
- SHA1 0e16af8f280a65f4acb413cb18c82716967a6713
- SHA512 92376802977a31f64865eb6af49469680d26b37fd7e1139d0fecdf454edcfa8b4f3c5f1defe8f9a6293a259ac2db389f633955c5c6cb4fc9c0a9d8ac7351c989
- SSDEEP 49152:p3qLRwItgqrJuJLvd+OWAkB6tGrSesb2ylL9n6tW/zDpjWZTXCQbfCyNNKjf8XXZ:pxvyUQgQhxCgNKjY2Ct
- TLSH T1D7E59D03E69440E8C4AEC178C71A9627EB72B88A1630B7AF1BE44B553F27F616F1D315
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detect suspicious telegram bot
Detect suspicious telegram bot.
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
2172528
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetModuleFileNameW
GetProcAddress
LoadLibraryExA
GetModuleHandleExA
GetOverlappedResult
CancelIo
VirtualFreeEx
CreateEventW
TerminateProcess
ReadFile
FindClose
SetFilePointer
SetThreadStackGuarantee
GetCurrentThread
GetProcessHeap
HeapFree
HeapReAlloc
SwitchToThread
LCMapStringW
CompareStringW
WriteFile
PostQueuedCompletionStatus
SetLastError
GetQueuedCompletionStatusEx
InitializeCriticalSectionEx
GetTimeZoneInformation
CreateIoCompletionPort
SetFileCompletionNotificationModes
GetCommandLineW
CancelIoEx
GetFinalPathNameByHandleW
OpenProcess
GetCommandLineA
GetFileType
RtlPcToFileHeader
InitializeCriticalSectionAndSpinCount
EncodePointer
DuplicateHandle
GetFileSize
CreateFileA
RtlUnwindEx
InitializeSListHead
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetFilePointerEx
CreateFileW
GetLastError
GetFileInformationByHandle
IsValidCodePage
GetModuleHandleW
SetStdHandle
GetCurrentThreadId
WaitForSingleObjectEx
LoadLibraryA
GetCurrentProcessId
CreateMutexA
ReleaseMutex
GetStdHandle
GetConsoleMode
GetACP
VirtualProtect
WriteConsoleW
HeapAlloc
ConnectNamedPipe
ReadFileEx
SleepEx
WriteFileEx
FlsFree
SetHandleInformation
CreateThread
GetModuleHandleA
GetFullPathNameW
SetFileTime
SetFileInformationByHandle
FindFirstFileExW
GetFileInformationByHandleEx
FlsSetValue
GetSystemTimePreciseAsFileTime
GetSystemDirectoryW
GetWindowsDirectoryW
GetFileAttributesW
FlsGetValue
WaitForMultipleObjects
GetExitCodeProcess
GetTempPathW
CopyFileExW
GetOEMCP
CreateWaitableTimerExW
SetWaitableTimer
Sleep
FlsAlloc
ExitProcess
FindNextFileW
FlushFileBuffers
GetTickCount
MapViewOfFile
CreateFileMappingW
GetSystemTime
GetSystemTimeAsFileTime
FreeLibrary
LockFileEx
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
GetSystemInfo
DeleteFileW
DeleteFileA
FlushViewOfFile
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapSize
HeapValidate
UnmapViewOfFile
UnlockFileEx
SetEndOfFile
GetFullPathNameA
LockFile
GetDiskFreeSpaceW
HeapCreate
AreFileApisANSI
GetModuleHandleExW
FreeLibraryAndExitThread
GlobalUnlock
WaitForSingleObject
GlobalLock
ExitThread
LocalFree
CreateRemoteThread
VirtualAllocEx
SetEnvironmentVariableW
CreateNamedPipeW
CreateProcessW
GetCPInfo
IsDebuggerPresent
CheckRemoteDebuggerPresent
LoadLibraryExW
TlsFree
Process32First
Process32Next
FreeEnvironmentStringsW
TlsSetValue
GlobalMemoryStatusEx
FindResourceA
LoadResource
CreateMutexW
GetCurrentProcess
LockResource
GetConsoleOutputCP
TlsGetValue
TlsAlloc
GetStartupInfoW
IsProcessorFeaturePresent
GetStringTypeW
SizeofResource
WriteProcessMemory
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
AddVectoredExceptionHandler
GetCurrentDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
lstrlenW
WideCharToMultiByte
RtlVirtualUnwind
MultiByteToWideChar
GetEnvironmentVariableW
QueryPerformanceFrequency
FormatMessageW
QueryPerformanceCounter
GetEnvironmentStringsW
CompareStringOrdinal
CloseHandle
FormatMessageA
SystemTimeToFileTime
OutputDebugStringW
OutputDebugStringA
RaiseException
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
ws2_32
send
freeaddrinfo
getaddrinfo
WSACleanup
WSAStartup
WSAIoctl
WSASend
bind
WSASocketW
recv
getsockname
getpeername
getsockopt
select
connect
ioctlsocket
closesocket
sendto
setsockopt
WSAGetLastError
shutdown
api-ms-win-core-synch-l1-2-0
WaitOnAddress
WakeByAddressAll
WakeByAddressSingle
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegEnumValueW
RegEnumKeyExW
GetTokenInformation
OpenProcessToken
CredFree
CredReadW
CredEnumerateA
crypt32
CertGetCertificateChain
CertDuplicateCertificateContext
CertVerifyCertificateChainPolicy
CertFreeCertificateContext
CertOpenStore
CertFreeCertificateChain
CertDuplicateStore
CertAddCertificateContextToStore
CertCloseStore
CryptUnprotectData
CertDuplicateCertificateChain
CertEnumCertificatesInStore
ntdll
NtCreateNamedPipeFile
NtDeviceIoControlFile
NtCancelIoFileEx
NtWriteFile
NtReadFile
NtOpenFile
NtCreateFile
RtlNtStatusToDosError
secur32
FreeContextBuffer
AcquireCredentialsHandleA
InitializeSecurityContextW
AcceptSecurityContext
ApplyControlToken
DecryptMessage
QueryContextAttributesW
EncryptMessage
FreeCredentialsHandle
DeleteSecurityContext
bcryptprimitives
ProcessPrng
shell32
ShellExecuteW
user32
CloseClipboard
GetKeyboardLayoutList
GetClipboardData
OpenClipboard
ReleaseDC
GetDC
GetSystemMetrics
gdi32
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
DeleteDC
BitBlt
GetDIBits
DeleteObject
Name
.text
Size
2.2MB
Virtual Size
2.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
528KB
Virtual Size
528KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
76KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
160KB
Virtual Size
160KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=152, id=261, version=33140,
count=19, id=260, version=33140,
count=10, id=259, version=33140,
count=10, id=259, version=35207,
count=16, id=260, version=35207,
count=41, id=261, version=35207,
count=282, id=1, productName=Unmarked objects,
count=1, id=260, version=35217,
count=32, productName=Unmarked objects (old),
count=1, id=258, version=35217,